sebbi.pro
Checks / EN 18286 / Readiness check
Free · 5 minutes · sealed result

EN 18286 readiness check

EN 18286:2026 is the first harmonised standard under the EU AI Act, cited by Commission Implementing Decision (EU) 2026/2274 on 14 October 2026. It sets the quality management system providers of high-risk AI need under Article 17, and meeting it gives a presumption of conformity. Answer one question per control and get your score, every gap with what good evidence looks like, and a readiness report sealed into Bitcoin that any customer, auditor or notified body can verify.

4 - The quality management system

Cl.4
quality management system established and documented
A written quality management system for your high-risk AI, approved and in use.
Cl.4
applicable AI Act requirements identified
A register of the AI Act requirements that apply to each system (Articles 8 to 15, 17, 72, 73).
Cl.4
QMS scope defined
A scope statement: which AI systems, sites and life-cycle stages the QMS covers.
Cl.4 / Art.17(1)(a)
regulatory compliance strategy incl. conformity assessment
Your route to conformity: which conformity assessment you use and how changes are re-assessed.
Cl.4
documented information controlled
Version control for QMS documents: owner, approval, date, and where the current copy lives.

5 - Leadership

Cl.5
top management commitment
Signed top-management commitment to the QMS and AI Act compliance.
Cl.5
quality policy
A short quality policy for AI that names compliance with the AI Act as an objective.
Cl.5
roles, responsibilities and authorities assigned
Named people for each QMS role, with what they are responsible and accountable for.
Cl.5 / Art.17(1)(m)
accountability framework
Who signs off what: an accountability chart for management and staff (Art. 17(1)(m)).

6 - Planning

Cl.6
risks to the QMS itself addressed
A list of risks to the QMS working as intended, with owners and actions.
Cl.6
quality objectives set
Measurable quality objectives with targets and review dates.

7 - Support

Cl.7 / Art.17(1)(l)
resource management incl. security of supply
Resource plan including security of supply for data, compute and key suppliers.
Cl.7
staff competence evidenced
Training and competence records for staff working on the AI system.
Cl.7 / Art.17(1)(j)
communication with authorities and notified bodies
A procedure for dealing with market surveillance authorities and notified bodies.

8 - AI system realisation

Cl.8.1
AI system life cycle defined
A defined AI life cycle (design to retirement) with the current stage recorded.
Cl.8.2 / Art.17(1)(g)
life-cycle risk management system
A risk management system that runs across the whole life cycle (Art. 9).
Cl.8.3 / Art.17(1)(b)
design and design control
Design inputs, reviews and design-change control for the AI system.
Cl.8.4 / Art.17(1)(d)
verification and validation before release
Test, verification and validation done before release, with results and acceptance criteria.
Cl.8.5 / Art.17(1)(f)
data management procedures
Data management procedures: collection, labelling, storage, filtering, retention (Art. 10).
Cl.8.6
retirement plan and deployer measures
A retirement plan, including what each deployer must do when the system is withdrawn.
Cl.8.7
unique reference for each assessed version
A unique reference for every version that went through conformity assessment.
Cl.8.8
pre-determined changes documented
Changes planned at design time for continuous learning, documented with how each is validated.
Cl.8.9 / Art.11(1)
technical documentation before market
Technical documentation (Annex IV) drawn up before release and kept up to date.

9 - Operations and control

Cl.9.1
unique identifier for each system placed on the market
A unique identifier on every system placed on the market, traceable through distribution.
Cl.9.2
deployer support and risk feedback channel
A support and feedback channel where deployers and users can report risks.
Cl.9.3
supply chain controls
A supplier register with controls on third-party components, data and models.
Cl.9.4 / Art.17(1)(a)
modification management
A modification procedure: how changes are assessed, approved and recorded.
Cl.9.5 / Art.17(1)(h)
post-market monitoring
A post-market monitoring plan with the data collected and how it feeds back (Art. 72).
Cl.9.6 / Art.17(1)(i)
serious incident reporting procedure
A serious-incident procedure with the 2, 10 and 15-day reporting clocks (Art. 73).
Cl.9.6
serious incident reported within 15 days
Your longest time to report a serious incident, in days. 15 or fewer passes.
Cl.9.7
non-compliance action (comply, withdraw, disable or recall)
A non-compliance procedure: bring into compliance, withdraw, disable or recall, and inform authorities.

10 - Performance evaluation

Cl.10.1
last management review date
The date of your last management review of the QMS.
Cl.10.2
change planning recorded
A record of planned changes to the QMS and how they will be carried out.

Records the AI Act asks for directly

Art.17(1)(k)
record-keeping system
A record-keeping system for all QMS documentation and records (Art. 17(1)(k)).
Art.12
automatic logging feeding QMS records
Automatic event logging switched on in the AI system itself (Art. 12), feeding your records.
Art.18
QMS documentation kept >= 10 years
How many years QMS documentation is kept. 10 or more passes (Art. 18).

Questions people ask about EN 18286

What is EN 18286?

EN 18286:2026, Artificial intelligence - Quality management system for EU AI Act regulatory purposes, is the first harmonised standard under the EU AI Act. It sets out the quality management system providers of high-risk AI systems need under Article 17.

When was EN 18286 cited in the Official Journal?

On 14 October 2026, by Commission Implementing Decision (EU) 2026/2274, which entered into force the same day.

Is EN 18286 mandatory?

No. Applying it is voluntary, but the AI Act obligations it covers are not. Meeting it gives a presumption of conformity with the requirements it covers; providers may also show compliance in other ways.

Which AI Act articles does EN 18286 give presumption of conformity for?

Article 17(1), the quality management system, and the first sentence of Article 11(1), technical documentation.

Does ISO/IEC 42001 certification mean EN 18286 or AI Act compliance?

No. ISO/IEC 42001 is a general AI management system standard. EN 18286 addresses the regulatory quality management requirements for providers of high-risk AI. The standard includes a clause-by-clause correspondence to ISO/IEC 42001, but holding 42001 does not by itself demonstrate AI Act compliance.

What are the serious incident reporting deadlines?

Reporting is triggered once a causal link between the AI system and the incident is established or reasonably likely. The outer limits run from when the provider becomes aware: 2 days for critical infrastructure, 10 days for a death, 15 days otherwise.

How do I check my organisation against EN 18286?

Answer the 36 questions on this page, one per control. You get a score, every gap with what good evidence looks like, and a readiness report sealed into a tamper-evident chain timestamped in Bitcoin that anyone can verify.

For developers

The whole standard as an open evidence format: /en-18286.json. Score a record by API with POST /x/en18286/assess, or from any AI assistant connected to https://sebbi.pro/mcp with sebbi_run_framework and framework=en18286. Each control also has its own page: all 36 EN 18286 checks.

Consultants, law firms and blogs: add this check to your site

Paste one line and your readers get a "Are you ready for EN 18286?" card that opens this free check:
<script src="https://sebbi.pro/en-18286/widget.js" async></script>
To place it somewhere specific, add <div id="sebbi-en18286"></div> where you want it.

Keep the evidence, not just the score

EN 18286 lives on records: logs, post-market monitoring, incident reports, reviews. sebbi.pro seals each one the moment it is made, so you can prove to an assessor what your AI actually did, not just what the policy says. Start sealing free
AI news
MIT Technology ReviewAI’s hidden storage bill: What inference leaves behind1hTechCrunchBlackstone’s Jas Khaira says fears over AI-buildout debt are overblown10hThe VergeMeta to create a new class of shares to fund AI push12hTechCrunchRecursive launches Flint, a laptop coding model it says was largely built by AI13hThe VergeAnthropic takes on Muse with Claude Duet, its new AI agent13hArs TechnicaThe new human-crafted Apple Music brand matters in an AI world14hTechCrunchWhile Amazon blocks AI agents, Walmart rolls out the welcome mat14hThe VergeWalmart is inviting AI agents to shop for you14hArs TechnicaOpenAI's latest AI models are coming to Google Cloud and Antigravity14hTechCrunchPHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet15hBBC NewsJust Eat apologises for AI food mistakes after social media ridicule16hArs TechnicaThe $15 billion ad-powered AI startup your doctor may already be using18hThe VergeConversational Gemini navigation comes to Apple CarPlay18hTechCrunchAI promises productivity, but for managers, it’s mostly a headache for now19hWiredAI Guardrails Aren’t Stopping Criminal Hackers19hThe VergeOpenAI says an AI agent lied about disabling its safety monitoring system19hWiredOpenAI Invests in Startup That Uses Brain Implants to Detect Cancer23hArs TechnicaMeta drops the word "train" from its commercial TOS after AI backlash1dArs TechnicaGemini's Personal Intelligence is coming to cars1dBBC NewsOpenAI CEO Sam Altman wins dismissal of sister's lawsuit1dMIT Technology ReviewThe new economics of enterprise AI1dMIT Technology ReviewAI adoption by industry shows what other sectors can learn1dBBC NewsEx-OpenAI worker accused of planting bug had Saudi support, claims prosecutors2dMIT Technology ReviewMaking the internet better for AI agents might make it worse for everyone else2dMIT Technology ReviewAI’s hidden storage bill: What inference leaves behind1hTechCrunchBlackstone’s Jas Khaira says fears over AI-buildout debt are overblown10hThe VergeMeta to create a new class of shares to fund AI push12hTechCrunchRecursive launches Flint, a laptop coding model it says was largely built by AI13hThe VergeAnthropic takes on Muse with Claude Duet, its new AI agent13hArs TechnicaThe new human-crafted Apple Music brand matters in an AI world14hTechCrunchWhile Amazon blocks AI agents, Walmart rolls out the welcome mat14hThe VergeWalmart is inviting AI agents to shop for you14hArs TechnicaOpenAI's latest AI models are coming to Google Cloud and Antigravity14hTechCrunchPHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet15hBBC NewsJust Eat apologises for AI food mistakes after social media ridicule16hArs TechnicaThe $15 billion ad-powered AI startup your doctor may already be using18hThe VergeConversational Gemini navigation comes to Apple CarPlay18hTechCrunchAI promises productivity, but for managers, it’s mostly a headache for now19hWiredAI Guardrails Aren’t Stopping Criminal Hackers19hThe VergeOpenAI says an AI agent lied about disabling its safety monitoring system19hWiredOpenAI Invests in Startup That Uses Brain Implants to Detect Cancer23hArs TechnicaMeta drops the word "train" from its commercial TOS after AI backlash1dArs TechnicaGemini's Personal Intelligence is coming to cars1dBBC NewsOpenAI CEO Sam Altman wins dismissal of sister's lawsuit1dMIT Technology ReviewThe new economics of enterprise AI1dMIT Technology ReviewAI adoption by industry shows what other sectors can learn1dBBC NewsEx-OpenAI worker accused of planting bug had Saudi support, claims prosecutors2dMIT Technology ReviewMaking the internet better for AI agents might make it worse for everyone else2d